Malicious PDF — malware analysis report

Static analysis result for SHA-256 e0e82ccacb7a813a…

MALICIOUS

PDF

41.3 KB Created: 2020-08-31 12:58:43 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 3b6544e46064d68c502c2a261863404a SHA-1: 26ad6b86de0b7553f94cf7a6f5537cfb2dc43f57 SHA-256: e0e82ccacb7a813ae64707edbc0f28e445009cdeafc01d03caab3f80add9b053
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a significant number of embedded URLs, with one heuristic specifically identifying it as a 'PDF_SEO_LINK_FARM'. Another heuristic flags a link to 'ttraff.com' as a known malicious redirector. The document body, though heavily obfuscated, contains the same suspicious URL. This suggests the primary purpose is to host a large number of links, likely for SEO poisoning or to redirect users to malicious content.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/wix?keyword=lana+scolaro+loses+top+uncensored
    • https://static.usrfiles.com/ugd/77941b_879f70d87084466682a3e35f39168c7d.pdf
    • https://static.usrfiles.com/ugd/9b33c5_68ac78d6e3b146189c15f92f1c005a68.pdf
    • https://static.usrfiles.com/ugd/6846fe_0366e110469d4230aa4fa0835bb7102f.pdf
    • https://cdn.shopify.com/s/files/1/0430/6888/3098/files/cabral_introduction_to_industrial_organization.pdf
    • https://cdn.shopify.com/s/files/1/0432/9832/4638/files/praxis_ii_general_science_study_guide.pdf
    • https://static.usrfiles.com/ugd/73c254_0c3f808ee4804dc496f0c4d25affece5.pdf
    • https://static.usrfiles.com/ugd/b8c837_dd4d65ea4f9444d2a5a347f9902067be.pdf
    • https://static.usrfiles.com/ugd/b8c837_3f4f84a6a05a415fadeb236f94690782.pdf
    • https://static.usrfiles.com/ugd/b8c837_ab5a2ddd97b54485a6a6a44b8f02f9f1.pdf
    • https://cdn.shopify.com/s/files/1/0448/9651/8299/files/oh_sing_elevation_worship_chords.pdf
    • https://cdn.shopify.com/s/files/1/0446/1009/3219/files/stripping_audio_from_video.pdf
    • https://cdn.shopify.com/s/files/1/0432/6676/9051/files/xozetomufisatojobinutu.pdf
    • https://cdn.shopify.com/s/files/1/0433/1339/7913/files/fuzitipeloxinodonem.pdf
    • https://cdn.shopify.com/s/files/1/0428/2885/7503/files/medicinal_chemistry_of_anticancer_drugs_free.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006454.bin
137aff772cefbe5eaee427ff1bbb1f825b5c8bec8a9a9211cf61b69f7aab6300		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6454 5008 bytes
font_01_sfnt_off0000756f.bin
ea9d077c2fa32850640c05753973e4e708fab2bbdff89e7096236930c3a57460		 pdf-font-stream PDF embedded font (sfnt) at offset 0x756F 10292 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.